Archive
February 2019
Vulnerabilities first published in this month (UTC), newest first.
847 results · Feed
-
Unscored —
Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication usi…
-
Unscored —
Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerabilit…
-
Unscored —
Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted…
-
Unscored —
A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D a…
-
Unscored —
A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location proper…
-
Unscored —
When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted conte…
-
Unscored —
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions gra…
-
Unscored —
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the U…
-
Unscored —
A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select eleme…
-
Unscored —
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a ra…
-
Unscored —
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on…
-
Unscored —
Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs sh…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some o…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed e…
-
Unscored —
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access you…
-
Unscored —
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, …
-
Unscored —
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through …
-
Unscored —
When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about wh…
-
Unscored —
If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not di…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed e…
-
Unscored —
The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when…
-
Unscored —
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an i…
-
Unscored —
By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and byp…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some o…
-
Unscored —
When manipulating user events in nested loops while opening a document through script, it is possible to trigger a pote…
-
Unscored —
In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-priva…
-
Unscored —
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other event…
-
Unscored —
During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of secu…
-
High 7.8CVE-2019-1674 Public exploit
Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability
A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient …
-
Critical 9.8
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary co…
-
Unscored —
In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an inse…
-
Unscored —
In event_handler of keymaster_app.c, there is possible resource exhaustion due to a table being lost on reboot. This co…
-
Unscored —
In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This …
-
Unscored —
In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due …
-
Unscored —
In onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could le…
-
Unscored —
In random_get_bytes of random.c, there is a possible degradation of randomness due to an insecure default value. This c…
-
Unscored —
In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation. This could lead…
-
Unscored —
In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition. This could l…
-
Unscored —
In SkSwizzler::onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. T…